Vulnerability Description
Remote Control Server, maintained by Steppschuh, 3.1.1.12 allows unauthenticated remote code execution when authentication is disabled, which is the default configuration. The server exposes a custom UDP-based control protocol that accepts remote keyboard input events without verification. An attacker on the same network can issue a sequence of keystroke commands to launch a system shell and execute arbitrary commands, resulting in full system compromise.
Related Weaknesses (CWE)
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exp
- https://remote-control-collection.com/
- https://www.vulncheck.com/advisories/steppschuh-remote-control-server-unauth-rce
FAQ
What is CVE-2022-4978?
CVE-2022-4978 is a documented vulnerability. Remote Control Server, maintained by Steppschuh, 3.1.1.12 allows unauthenticated remote code execution when authentication is disabled, which is the default configuration. The server exposes a custom ...
How severe is CVE-2022-4978?
CVSS scoring is not yet available for CVE-2022-4978. Check NVD for updates.
Is there a patch for CVE-2022-4978?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.